Google CVE-2026-6311

We need to produce a JSON object.

Let's analyze the information:

• CVE ID: CVE-2026-6311
• Product: Google Chrome on Windows (from description). Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with version prior to 147.0.7727.101. So product_name: "Google Chrome" (3 words, specific product).
• Summary: Should be plain-language, original synthesis. Impact: Uninitialized use in Accessibility component allows attacker who compromised renderer to perform sandbox escape via crafted HTML page. Chromium security severity: High. EPSS: 0.02% low. No KEV. Patch available. Use data: remotely accessible, but attacker already needs renderer compromise. So the vulnerability exists within the browser, but exploit requires prior renderer compromise (maybe via another bug). So an attacker can escape the sandbox after compromising the renderer process. Mentions "remote attacker" but AV:N AC:H PR:N UI:R Scope Changed. But the description says "who had compromised the renderer process" i.e., that pre-condition of renderer compromise is needed, which is not reflected in CVSS vector? But the CVSS is from source. So we'll note this nuance. Not actively exploited, no POC mentioned. So summary: "Sandbox escape in Google Chrome on Windows prior to 147.0.7727.101 can be triggered by a remote attacker who has already compromised the renderer process, via a crafted HTML page, due to uninitialized memory use in the Accessibility component. This could allow escalation of privileges from the renderer sandbox to the broader system. No known active exploitation or public exploit code."
• Technical context: CWE-457: Uninitialized Use. Accessibility component likely interfaces with Windows accessibility APIs (like IAccessible). Uninitialized memory can lead to arbitrary code execution. The renderer process is sandboxed, so escaping requires leveraging the bug to break out. Apple? CPE only Chrome. Use references to explain. Mention that vulnerability is due to using uninitialized variable in Ac